Update auto-approval product config

Partially update one product's auto-approval rule. Requires read_write scope and a single shop. Omitted fields keep their current value; an explicit null clears the setting. config_id is re-checked against this shop before the write — a config belonging to another shop returns 404, never a cross-shop update.